Folks In my understanding, SELinux (and other current practice) NEVER allows malloc() memory to be executable. The Linux mmap model allows the execute bit to be enabled for malloc memory, but this is a deviation from POSIX.
Memory that is to be executable should be obtained from mmap(). Also, it should NOT be writable (otherwise, another SELinux exception will be triggered). This means that the memory must be mapped twice -- once to execute, and once to write. This is the issue that is causing TCC to not do the "-run" on Fedora Core 5. As soon as the new "main()" is called (attempted), an access violation is raised (and correctly so -- this may have been an attempted buffer overrun exploit, etc.). As I see it, we have several ways out: (1) "-run" creates an executable which is then run via normal exec() semantics. This is an "easy" fix. (2) Modify the entire compiler to use mmap() semantics rather than malloc(). (3) Leave the malloc() semantics in place, and do a final copy when tcc_run() is executed. This final copy is to mmap() memory, with the correct permissions. I am leaning toward solution (3) -- it is POSIX compliant, and Fedora Core compliant, and shouldn't break existing systems. It is also isolated enough that a conditional compilation can be put around it. What do you think? fred at weigel-mohamed dot org _______________________________________________ Tinycc-devel mailing list [email protected] http://lists.nongnu.org/mailman/listinfo/tinycc-devel
